Ransomware: Encryption Turned Against You

Ransomware is the malware behind the headlines about shut-down hospitals and frozen fuel pipelines. It works by turning a tool for good against you: it scrambles your files so you can't open them, then demands payment to unscramble them. Everything Olivia learned about encryption earlier — locking information so only the right person can read it — is exactly what makes ransomware so hard to fight.

Ransomware is malware that encrypts your files and then demands a payment, the ransom, in exchange for the key that unlocks them. The lock is real, not a trick, and the attacker is the only one holding the key.

Think of a burglar who takes nothing from your house. Instead, they weld an unbreakable lock onto your front door and then offer to sell you the only key. Your possessions are still right there, untouched — you just can't reach them. Ransomware lives entirely in that gap between "still there" and "can't reach it."

What Ransomware Does

When ransomware runs on a device, it encrypts the files it can reach — documents, photos, spreadsheets, sometimes whole systems. Encrypting here means scrambling each file with a secret key so it becomes unreadable noise. The files are still sitting on the disk, but without the key they may as well be gone.

This is an attack on availability — one of the three things security protects, the goal of having your information there when you need it. The data hasn't been stolen, and it isn't gone — it has simply been locked away where no one can use it. A business whose files are all locked at once can grind to a halt in minutes.

Why It Is So Damaging

The cruel part is that the encryption is the real, proper kind. Done correctly, encryption can't be undone without the key — that is the entire reason it works as a defense everywhere else. Ransomware borrows that same strength and points it at you.

So if Olivia's only copy of a file is the one that got encrypted, and the attacker holds the only key, the file may be genuinely unrecoverable. There is no clever trick to reverse strong encryption from the outside. That is why ransomware is so feared: the lock that protects honest data is just as unbreakable when it is working against you.

The Modern Twist: Double Extortion

Newer ransomware adds a second threat. Before locking the files, the attackers quietly copy them first. Now they have two forms of pressure: they can keep your files locked, and they can threaten to publish your private data unless you pay. This pairing is called double extortion.

The nasty consequence is that paying for the key no longer makes the problem go away. Even if your files are unlocked, the attacker still has a copy of your confidential data — so a breach of secrecy has already happened, and paying can't un-happen it.

Why Backups Are the Real Answer

If the attacker's power comes from holding the only key to your files, that power disappears the moment you have another copy. A backup — a separate, spare copy of your files kept somewhere safe — lets you rebuild your data without ever dealing with the attacker. You restore from the backup and walk away.

For a backup to survive ransomware, it has to be out of the malware's reach — ideally offline or otherwise separated, so it doesn't get encrypted along with everything else. This is the direct reason backups get their own topic later in the course: against ransomware, a clean backup is the difference between restoring and paying-and-hoping.